Privacy.

Board Badger is operated by Moonlathe Technologies Ltd, a company registered in England and Wales (company number 17493793), referred to here as the Operator. The Operator is registered with the Information Commissioner's Office (ICO), registration number ZC266615. This notice is kept short on purpose: it is the whole of what the service does with personal data.

Who is responsible for what

There are two roles here, and which one applies decides who answers a request.

The Operator is the controller of account data: the email address an account holder signed up with, their password hash, and the record of their own use of the service. Requests about that go to the Operator, and the Operator answers them.

The Operator is a processor of everything on a board: its name, its tasks, the descriptions, files and comments on them, and the name and email address of each person invited to it. The account holder is the controller of all of that. They decide what goes on a board and who may read it, and the Data Processing Agreement sets out the terms the Operator holds it under.

What is held

For an account holder: the email address they signed up with, a hash of their password, the name they set if they set one, a new address they have asked to move to until the link sent to it is used or runs out, and the boards they keep. For a board: its name, the client's name, and every task on it, with its title, its description, its state, the comments left on it and any file attached to it, with its name, size, type and who added it when.

For somebody invited to a board: the name and email address the account holder entered, the role they were given, which board it was, and the record of what they ticked off or commented on. Those details are entered by the account holder about their own client contacts.

Importing from Trello

An account holder on Studio can import a Trello board. What is read from Trello, its lists and cards, their descriptions, and the comments with the names of the people who wrote them on Trello, is held for up to one hour so the preview can be shown, and is deleted as soon as the import runs. Connecting Trello instead of uploading an export stores a read only Trello access token for up to one hour, deleted once the import has run. What is imported becomes tasks on the board and is kept like any other task. Nothing is ever written back to Trello.

What it is used for

To run the board, to send the invitation that opens it, and to tell the people on a board when a task moves or a comment lands. Email is sent through Resend. Files attached to a task are stored privately in Cloudflare R2. Everything else is held in Cloudflare D1, the database Board Badger runs on.

There is no analytics on this site, no advertising, and no third party script at all. Once the Cloudflare Turnstile bot check is switched on, sign up and sign in will load it from Cloudflare, and no other page will load anything from anywhere else.

Cookies

Three, all strictly necessary, set out in full in the cookie notice. None of them tracks anybody across sites.

Keeping it, and deleting it

A board is kept for as long as its account is open, because that is the product. Revoking somebody's access ends it at once and keeps their name against the tasks they ticked off: a board that forgets who did what stops being a record. Email already sent sits in Resend's own sending log for a short period, which is outside the Operator's control beyond the choice of provider.

Closing an account is done from the account page. Typing the account's email address and its password to confirm deletes the account, its boards, their tasks, their comments and the membership records at that moment, ends the access of everybody invited to those boards, and disconnects every agent the account had connected. There is no undo. Residual copies sit in the hosting provider's automated backups until those age out on the provider's own schedule.

Somebody who cannot sign in any more can write to privacy@boardbadger.com from the account's own address instead, and the Operator deletes it by the same steps within one month.

Rights, and how to use them

Under UK GDPR an account holder may ask for a copy of their data, ask for it to be corrected or deleted, or object to how it is used. Three of those need no request: the account page has a download of every board, task, comment and invited person on the account as one JSON file, a way to change the name and the email address on it, and a way to delete it. Anything else goes to privacy@boardbadger.com and is answered within one month. There is no charge.

Somebody invited to a board is in the other half of the split above. Their name and address are on a board their own client or supplier controls, so a request about what is on that board goes to the account holder who invited them. Writing to the Operator at the same address still works: the request is passed to that account holder without delay, the Operator assists them in answering it, and the person who wrote is told that is what has happened.

Anyone unhappy with the response may complain to the Information Commissioner's Office at ico.org.uk.